MalwareBleeping Computer
9.0 — CRITICAL
New Spirals ransomware encrypts victim network in under 24 hours
A new ransomware actor called Spirals completed a corporate intrusion, from initial access to data theft and encryption, in less than 24 hours. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Spirals ransomware actor breached an IT services firm in South Asia, encrypting victim network in under 24 hours, and demanding a ransom for data recovery within six days.
⚙️Technical Details
Affected Systems
IIS server exposed on the public web
Attack Vectors
Initial access via IIS serverASP.NET web shell uploadWMI lateral movement to more than a dozen systemsRemote Desktop and local account creation for persistent accessPsExec running as SYSTEM for payload deployment
💥Impact Assessment
Severity: critical
Who Is at Risk
IT services firm in South Asia with backup, database, and virtualization products affected
🛡️Recommended Actions
1Regularly update and patch IIS servers to prevent exploitation of exposed web services
2Implement WMI monitoring and logging to detect suspicious activity
3Conduct thorough network scans for potential Spirals ransomware deployment
📦Affected Products
VeeamVMwareHyper-VSQL ServerOraclePostgreSQL
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.